Detections
Analytics
Microsoft IIS Unicode Remote Command Execution
critical Nessus Plugin ID 10537
Synopsis
Arbitrary code can be executed on the remote host.Description
The hotfix for the 'Webserver file request parsing' problem has not been applied.This vulnerability can allow an attacker to make the remote IIS server execute arbitrary commands.
Solution
Microsoft has released a set of patches for IIS 4.0 and 5.0.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2000/ms00-078
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2000/ms00-086
Plugin Details
Severity: Critical
ID: 10537
File Name: iis_dir_traversal.nasl
Version: 1.63
Type: remote
Family: Web Servers
Published: 10/18/2000
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 10/17/2000
Reference Information
CVE: CVE-2000-0884
BID: 1806